Data Controller
The data controller responsible for your personal data under this Privacy Policy is:
NextStep Engineering Software Solutions Co., Ltd.
689 Bhiraj Tower @ EmQuartier, Floor 30, Sukhumvit (Soi 35)
Khlong Tan Nua, Vadhana, Bangkok 10110, Thailand
Email: privacy@nextstep.engineer
Phone: +66 2 017 2700
This policy is written to meet the requirements of the Thai Personal Data Protection Act B.E. 2562 (2019) (PDPA), and serves as our global baseline for how we handle personal data from visitors anywhere in the world.
We have not appointed a separate Data Protection Officer. For any question, request, or complaint about this Privacy Policy or how we handle your personal data, please contact us using the details above or in the "How to contact us" section below.
Scope of this policy
This Privacy Policy covers only personal data processed through this website (nextstep.engineer), for example when you use our contact form. It does not cover personal data that NextStep may process while delivering software, consulting, or engineering services to clients under a separate services agreement; those engagements are governed by the terms agreed with the relevant client, not by this policy.
What data do we collect?
NextStep collects the following categories of personal data:
| Data | Source | Purpose |
|---|---|---|
| Name | Contact form | Identifying you and communicating with you |
| Business email address | Contact form | Responding to your inquiry |
| Company name | Contact form | Understanding the business context of your inquiry |
| Subject | Contact form | Directing and categorizing your inquiry |
| Message | Contact form | Understanding and responding to your inquiry |
| Technical/log data (e.g. IP address, device/browser information, request logs) | Website security provider (Cloudflare) | Website security |
We do not knowingly collect any special categories of personal data (for example, health, religious belief, or biometric data) through this website.
How do we collect your data?
You directly provide NextStep with most of the data we collect. We collect data and process data when you:
- Contact us via the contact form on our website and provide your personal details (name, business email address, company name, subject, and message content).
NextStep does not receive any other of your data directly or indirectly from any other sources.
Legal basis for processing
Under the Thai Personal Data Protection Act B.E. 2562 (2019) ("PDPA"), we map each processing activity to the legal basis that applies to it, rather than relying on a single basis for everything:
| Processing activity | Purpose | Legal basis |
|---|---|---|
| Contact form (name, business email, company name, subject, message) | Responding to your inquiry | Legitimate interests – responding to inquiries you have chosen to send us. Where your inquiry concerns a prospective business engagement, we may instead rely on necessity for steps taken at your request prior to entering into a contract. |
| Technical/log data processed by Cloudflare | Website security | Legitimate interests – keeping the website secure and functioning correctly. |
| Retention of your contact-form submission for 6 months | Record keeping and business administration | Legitimate interests – maintaining a record of the inquiry and our response for that period. |
| Marketing | Not applicable | NextStep does not use contact-form data for marketing. If this changes, we will update this table and, where required, ask for your consent. |
Where we rely on legitimate interests, we have considered that our interest in responding to your inquiry, securing the website, and keeping business records is proportionate to the limited data involved and does not override your rights and freedoms. You have the right to object to processing carried out on this basis (see "What are your data protection rights?" below).
Before you can use the contact form, our website shows a notice with two choices: “Decline” and “Accept.” To be clear about what this choice does and does not cover:
- It does not control the Cloudflare cookies described in "Cookies" below; those apply regardless of your choice because they are necessary for the website to function securely and are not consent-gated.
- It does not constitute PDPA consent to processing. The legal bases for processing your data are set out in the table above (mainly legitimate interests), not this notice.
- It does specifically gate the contact form: selecting "Accept" turns the form on and confirms you have seen that your submission is sent to Web3Forms and forwarded to our Zoho Mail inbox (see "Web3Forms" and "Email provider: Zoho Mail" below).
- It does not apply to anything else on the website; it has no effect beyond enabling or leaving disabled the contact form itself.
In short, this notice is a transparency and access-control measure for one specific feature (the contact form), not a blanket consent mechanism for the website as a whole.
Is providing your data required?
Providing your personal data through the contact form is voluntary, but it is necessary if you want us to respond to your inquiry. The name, business email address, company name, subject, and message fields are required to identify you and reply to your message.
If you do not provide this data, or if you select "Decline" on the contact-form notice, you will not be able to submit the contact form and we will not be able to process or respond to your inquiry. You can still browse the rest of the website without providing any personal data, other than the technical data described above, which is necessary for the website to function securely.
How will we use your data?
NextStep collects your data so that we can:
- Process your inquiry from contact form and replying to you.
As set out in the table above, we rely on legitimate interests as the legal basis for this processing (or, where your inquiry concerns a prospective business engagement, necessity for steps taken at your request prior to entering into a contract).
Except for the recipients described below, NextStep will NOT share any of your data with any other company.
Who do we share your data with?
We do not sell your personal data. We only share it with the following categories of recipients, each of which helps us operate this website and respond to you:
- Web3Forms – our contact-form processor, which receives and forwards your submissions to us (see below).
- Cloudflare – our content-delivery and security provider, which processes limited technical data to protect the website (see "Cloudflare" below).
- Zoho Mail – operated by Zoho Corporation, hosts the inbox we use to receive and reply to your messages (see "Email provider: Zoho Mail" and "International data transfers" below).
We do not share your data with any other third party, except where required by law.
Web3Forms
Our contact form uses Web3Forms, a third-party form-processing service, to deliver your inquiry to us. For the purposes of this Privacy Policy, we treat Web3Forms as a data processor acting on our instructions; its role is limited to receiving your submission and forwarding it to us.
| Data sent | The fields you complete: name, business email address, company name, subject, and message. Plus a fixed account identifier and sender label our website uses to route the message; these two values are the same for every submission and are not derived from your personal data. |
|---|---|
| Also collected automatically |
Your IP address, browser/user-agent, and a
timestamp — standard HTTP request information that any server
logs, not data our website code separately collects or adds. Because our
website does not set a custom Referrer-Policy, browsers send at most our
site’s origin (https://nextstep.engineer), not the full page
path, as a referrer.
|
| Why it’s sent | So Web3Forms can forward your inquiry to NextStep’s email inbox and we can respond to you. |
| Retention | Per Web3Forms' privacy policy, form submission data is retained for up to three years from the date of submission, then automatically deleted. Its server logs (which may incidentally include your IP address and user-agent) are deleted on a regular basis. |
| Where it’s processed | United States (US-East), per Web3Forms. |
| Legal basis for the US transfer | PDPA Section 28 — see "International data transfers" below for the specific mechanism we rely on and the contractual safeguards that apply to this transfer. |
| Spam-filtering services | Our Web3Forms account has "Advanced Spam Filter" enabled (Basic protection level), and Captcha Protection set to "None." Per Web3Forms' privacy policy, this spam filtering may use third-party services (CleanTalk and/or Akismet), which can receive a submitter's IP address and email address. |
Our contact form does not use a CAPTCHA, honeypot, or any other anti-spam/security field.
Learn more in the Web3Forms privacy and GDPR FAQ.
Email provider: Zoho Mail
Web3Forms forwards your contact-form submission to our email inbox, which is hosted by Zoho Mail (operated by Zoho Corporation) on Zoho's United States data center.
Zoho offers a Data Processing Addendum, based on Model Contractual Clauses, on request; NextStep has not entered into this agreement with Zoho. See "International data transfers" below for the transfer mechanism we rely on for this recipient, and "Retention" below for how long your data may exist in this inbox and in Zoho's own systems (such as Trash).
International data transfers
Three of the recipients described above process data outside Thailand. Where this happens, Section 28 of the PDPA requires us to explain the recipient country, the reason for the transfer, the transfer mechanism we rely on, and any contractual safeguards in place:
| Recipient | Recipient country | Reason for transfer | Transfer mechanism | Contractual safeguards |
|---|---|---|---|---|
| Web3Forms (contact-form processor) | United States (US-East) | To receive your contact-form submission and forward it to us so we can respond to your inquiry | Necessary to take steps you have requested, prior to or in connection with our response to your inquiry (PDPA Section 28) | Web3Forms states that its Data Processing Agreement, incorporating Standard Contractual Clauses for international transfers, is part of its Terms of Service and applies automatically to all customers, including NextStep. We have not separately reviewed or negotiated this agreement. |
| Cloudflare (content delivery & security) | Global network; may include countries outside Thailand | To deliver this website to you and protect it from malicious traffic | Necessary for our legitimate interest in keeping the website secure, and/or necessary to take steps you have requested by using the website (PDPA Section 28) | NextStep has not independently reviewed a data processing agreement specific to this website with Cloudflare. |
| Zoho Mail (email hosting) | United States (Zoho's US data center) | To host the inbox where your contact-form submission is delivered, so we can read and reply to it | Necessary to take steps you have requested, prior to or in connection with our response to your inquiry (PDPA Section 28) | Zoho offers a Data Processing Addendum, based on Model Contractual Clauses, on request; NextStep has not entered into this agreement with Zoho. |
You have the same rights in relation to these transfers as set out in "What are your data protection rights?" below, including the right to object to processing and the right to lodge a complaint with the Personal Data Protection Committee (PDPC) (see "Complaints" below). Please contact us at privacy@nextstep.engineer for more information about a specific transfer.
Retention
NextStep will keep your (email) data for 6 months. Once this time period has expired, we will delete your data by retention policy. Because different systems in this chain are governed by different retention rules, here is how long your data may exist in each of them:
| System | Retention |
|---|---|
| Your inquiry in our Zoho Mail inbox | 6 months, then deleted by NextStep under our own retention policy above. |
| Web3Forms (contact-form processor) | Up to three years from the date of submission, per Web3Forms' privacy policy, then automatically deleted. |
| Web3Forms server logs (may incidentally include IP address/user-agent, as described above) | Web3Forms states these logs are deleted on a regular basis. |
| Zoho Mail Trash (if an email is deleted before the 6-month period above) | Per Zoho's published policy: 5–180 days in Trash depending on our configured cleanup interval, then a further 30-day server-side recovery window, after which it is permanently and irrecoverably deleted. |
| Cloudflare security event logs | Up to 24 hours, per Cloudflare's published documentation for our plan. |
| Cloudflare security analytics logs | Up to 7 days, per Cloudflare's published documentation for our plan. |
| Backups, local copies, or a CRM system | None. NextStep does not maintain a separate backup, a local copy, or a CRM record of your inquiry outside the Zoho inbox described above. |
Security
We do not disclose implementation details that could themselves create a security risk, but at a high level, here is how your data is protected:
- Encryption in transit – All data you submit through our contact form travels over HTTPS, and Cloudflare terminates TLS for traffic to our website.
- No NextStep-operated database – This website is static and has no server or database of its own that stores your data. Once Web3Forms forwards your submission, it resides in the Zoho Mail inbox described above and, per Web3Forms' own privacy policy, in Web3Forms' systems for up to three years — both governed by the retention periods in the table above.
- Access controls – Access to the Zoho Mail inbox, our Cloudflare account, and our Web3Forms account requires multi-factor authentication (MFA).
- Third-party security – Web3Forms and Cloudflare each apply their own security measures to the data they process on our behalf; see "Web3Forms" and "Cloudflare" above.
No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. See "How we handle security incidents" below for what happens if something goes wrong.
How we handle security incidents
NextStep does not currently have a separate, formal incident-response document, given the limited scope of personal data this website processes (contact-form inquiries only). If we become aware of a security incident affecting your personal data, we will investigate it and take appropriate steps to contain and address it.
Where the PDPA's breach-notification obligations apply, we will notify the Personal Data Protection Committee (PDPC) without undue delay and, where feasible, within 72 hours of becoming aware of a breach that is likely to result in a risk to your rights and freedoms. Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly, without delay, describing what happened and what we are doing about it.
Because Web3Forms and Zoho Mail process your data on our behalf, a security incident at either of them could also affect your data. As noted in "Web3Forms" and "International data transfers" above, we do not currently have a signed agreement with either provider that contractually guarantees they will inform us of an incident on their end. This is a gap we are aware of and are working to close. If you believe your data may have been affected by an incident at either provider, please contact us at privacy@nextstep.engineer.
You can also contact the PDPC directly; see "Complaints" below.
What are your data protection rights?
NextStep would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following:
The right to withdraw consent – Where we process your data on the basis of consent, you have the right to withdraw that consent at any time, for example by using the "Privacy choices" control on our website or by contacting us. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
The right to access – You have the right to request NextStep for copies of your personal data. Access requests are generally free of charge. We will only charge a fee where the PDPC's rules allow it (for example, for a special format you request, for delivery costs, or where a request is repetitive or excessive), and we will tell you the fee before processing the request.
The right to rectification – You have the right to request that NextStep correct any information you believe is inaccurate. You also have the right to request NextStep to complete information you believe is incomplete.
The right to erasure – You have the right to request that NextStep erase your personal data, under certain conditions.
The right to restrict processing – You have the right to request that NextStep restrict the processing of your personal data, under certain conditions.
The right to object to processing – You have the right to object to NextStep’s processing of your personal data, under certain conditions.
The right to data portability – You have the right to request that NextStep transfer the data that we have collected to another organization, or directly to you, under certain conditions.
How we verify your identity: Before responding to a request, we will verify that it comes from you (or someone authorized to act for you), for example by confirming details against the contact-form submission or email address on record. If we cannot verify your request, we will tell you what additional information we need.
When we may refuse a request: We may refuse or limit a request where disclosure is prohibited by law or a court order, where it would affect the rights (including intellectual property rights) of another person, where the request is unfounded, or for other reasons permitted under the PDPA and its notifications. If we refuse a request, we will explain why.
If you make a request, we have 30 days to respond to you, which we may extend by up to a further 30 days for large or complex requests (we will notify you if we do). These timelines reflect the PDPC's Notification Re: Rules on Requests for Access to and Obtaining Copies of Personal Data (B.E. 2569/2026), which takes effect on 14 September 2026. If you would like to exercise any of these rights, please contact us at our email:
Call us at: +66 2 017 2700
Or write to us: privacy@nextstep.engineer
If you are not satisfied with how we have handled your request, you can lodge a complaint with the Personal Data Protection Committee (PDPC); see "Complaints" below.
Children’s privacy
This website is a business-to-business (B2B) website intended for professional and business inquiries. It is not directed at, or intended for use by, children, and we do not knowingly collect personal data from children through the contact form. If you believe a child has provided us with personal data, please contact us at privacy@nextstep.engineer so we can delete it.
Automated decision-making and profiling
NextStep does not use automated decision-making, profiling, or AI systems to process the personal data collected through this website. References elsewhere on this website to "AI & Analytics" or similar services describe solutions NextStep offers to its clients; they do not describe how this website processes your own personal data.
We confirmed this by reviewing the website's code, which runs no analytics, AI, or profiling tools of any kind (see "Cookies" above for the related review of tracking scripts). If this changes in the future, we will update this Privacy Policy before the change takes effect.
Third-party websites
The NextStep website contains links to other websites. Our privacy policy applies only to our website, so if you click on a link to another website, you should read their privacy policy.
Changes to our privacy policy
NextStep keeps its privacy policy under regular review and places any updates on this web page. Current version: 27 August 2026 (see "Last updated" at the top of this page). Version history:
- 7 March 2026 – Original policy published.
- 5 August 2026 – Web3Forms addendum added.
- 26 August 2026 – Revised to align with Section 23 of the Thai PDPA: added a Data Controller section, legal basis for processing, whether providing data is required and the consequences of not providing it, a consolidated recipients section, and an international data transfers section.
- 27 August 2026 – Revised following legal review: verified and corrected the specific data sent to and retained by Web3Forms, Cloudflare, and Zoho Mail; added a legal-basis table, a retention-periods table, an international-transfers table, a Cloudflare cookie table, a Security section, and a "How we handle security incidents" section; clarified what the contact-form notice does and does not cover; expanded data-subject-rights procedures (identity verification, refusal grounds, PDPC access-request timelines); corrected the supervisory authority reference from the UK Information Commissioner's Office to the Personal Data Protection Committee (PDPC), Thailand; and restructured the whole policy into 16 clearly numbered topics, each with sub-topics nested underneath, matching the structure used by major B2B technology companies.
How to contact us
If you have any questions about NextStep’s privacy policy, the data we hold on you, or you would like to exercise one of your data protection rights, please do not hesitate to contact us.
Email us at: privacy@nextstep.engineer
Call us: +66 2 017 2700
Or write to us at:
689, BHIRAJ TOWER@EMQUARTIER, FLOOR 30, SUKHUMVIT ( SOI 35), KHLONG TAN NUA, VADHANA, BANGKOK 10110